Simplifying authentication

Finding the right amount of authentication

IT security departments are defending against cyber-attacks which are becoming more subtle, most of which can be traced back to stolen or weak passwords, and – to the irritation of end users – they are introducing more and more restrictive measures in assigning passwords. The users may not use any names or simple words; instead they are required to use numbers, letters, upper and lower case, and special characters. The length is required to be at least 10 digits, they must be updated every 14 days, and users must not, under any circumstances, use the same password for everything. These are just some of the most frequently applied rules of password assignments.

More and more accounts, constantly growing support effort and increasing costs

What seems to be essential from an IT perspective, is, however, hardly practical from a user perspective, because human memory has its limits. Every user tries to simplify the act of remembering complex passwords, and this leads to simple passwords, or one and the same code is used for multiple accounts. Users might also save the account files unencrypted in Excel files. The constantly growing number of accounts inevitably leads to increasing numbers of forgotten passwords as well – a type of forgetfulness that can become very expensive for businesses. A password reset is, first and foremost, annoying and time-consuming for users, but it can also have a negative impact on a company’s bottom line due to the costs for each reset operation which can be considerable in some cases.

Security has to be practical

So, what can businesses do to protect themselves from identity theft? Security solutions that require an extensive security procedure for each and every access to applications and systems make it difficult for employees to do their daily work, and they lead to productivity losses. What is needed are user-friendly and scalable multi-factor authentication (MFA) methods. Many different solution scenarios are conceivable, e.g., combining a password with a security token for a single sign-on (SSO) solution. In this case, the user only needs to remember one password for all applications, but an additional level of security is gained by the use of a security token.